What is the CVSS score of CVE-2025-68575?

CVE-2025-68575 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of Wordpress Plugin are affected by CVE-2025-68575?

Wappointment WordPress plugin versions 2.7.6 and earlier contain an authorization bypass vulnerability (CVE-2025-68575, CVSS 8.8) that allows authenticated users to access and modify data beyond…

How to fix or mitigate CVE-2025-68575?

Within 24 hours: Audit Wappointment plugin version on all WordPress instances and disable the plugin if version 2.7.6 or earlier is installed. Within 7 days: Contact Wappointment vendor for patch timeline and identify alternative scheduling solutions if patching is delayed beyond 30 days. Within 30 days: Apply vendor patch immediately upon release and upgrade to the patched version; if no patch is released, replace Wappointment with an alternative plugin with current security maintenance.

Wordpress Plugin CVE-2025-68575

MEDIUM

Missing Authorization (CWE-862)

2025-12-24 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Severity Changed

Apr 23, 2026 - 15:43 NVD

HIGH MEDIUM

CVSS changed

Apr 23, 2026 - 15:43 NVD

8.8 (HIGH) 5.3 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Dec 24, 2025 - 13:16 nvd

HIGH 8.8

DescriptionCVE.org

Missing Authorization vulnerability in Wappointment team Wappointment wappointment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wappointment: from n/a through <= 2.7.6.

AnalysisAI

Authorization bypass in Wappointment WordPress plugin versions ≤2.7.6 enables low-privileged authenticated attackers to perform unauthorized actions with high impact to confidentiality, integrity, and availability. The vulnerability stems from missing authorization checks (CWE-862), allowing authenticated users to access or modify data beyond their intended permission level. EPSS score of 0.06% (18th percentile) indicates low observed exploitation probability, and no confirmed active exploitation (CISA KEV) or public exploit code is identified at time of analysis.

Technical ContextAI

This vulnerability affects Wappointment, a WordPress appointment booking plugin, through a missing authorization implementation (CWE-862: Missing Authorization). CWE-862 occurs when an application does not verify that a user has the appropriate permissions before granting access to sensitive operations or resources. In WordPress plugins, this typically manifests when AJAX handlers, REST API endpoints, or admin functions fail to implement capability checks (e.g., current_user_can()) before executing privileged operations. The vulnerability allows low-privileged authenticated users (PR:L in CVSS vector) to exploit improperly configured access control mechanisms, potentially accessing appointment data, modifying bookings, or manipulating plugin settings that should be restricted to administrators. The network-accessible attack vector (AV:N) with low attack complexity (AC:L) means exploitation requires only standard HTTP requests once authenticated, without additional conditions or race conditions.

Affected ProductsAI

The vulnerability affects Wappointment WordPress plugin versions up to and including 2.7.6. Wappointment is an appointment booking and scheduling plugin for WordPress developed by Wappointment team, commonly used by service businesses, healthcare providers, and consultants to manage client appointments. All installations running version 2.7.6 or earlier contain the missing authorization vulnerability. The vendor advisory is available through Patchstack at https://patchstack.com/database/Wordpress/Plugin/wappointment/vulnerability/wordpress-wappointment-plugin-2-7-2-broken-access-control-vulnerability?_s_id=cve which provides detailed affected version information and exploitation details.

RemediationAI

Update Wappointment plugin to version 2.7.7 or later, which addresses the missing authorization checks. WordPress administrators should navigate to the WordPress admin dashboard, select Plugins, locate Wappointment, and click Update if the update is available through the WordPress plugin repository. For installations where immediate patching is not feasible, implement temporary compensatory controls by restricting WordPress user roles to only trusted administrators and reviewing user permission levels to minimize the attack surface for low-privileged accounts. Conduct an audit of appointment data and plugin settings to identify any unauthorized modifications that may have occurred prior to patching. Consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wappointment/vulnerability/wordpress-wappointment-plugin-2-7-2-broken-access-control-vulnerability?_s_id=cve for additional remediation guidance and indicators of compromise specific to this vulnerability.